name: Qodana
on:
  workflow_dispatch:
  pull_request:
  push:
    branches: # Specify your branches here
      - main # The 'main' branch
      - 'releases/*' # The release branches

jobs:
  qodana:
    # Use GitHub-hosted runners for PR scans so untrusted code never runs on persistent internal infrastructure.
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
      checks: read
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}  # Use PR head when available, otherwise the pushed SHA.
          fetch-depth: 0  # a full history is required for pull request analysis
          persist-credentials: false
      - name: Mark repository as safe for Git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - name: Prepare Qodana cache directories
        run: |
          mkdir -p "${RUNNER_TEMP}/qodana/caches"
          mkdir -p "${RUNNER_TEMP}/qodana/results"
      - name: Detect Qodana Cloud token
        id: qodana-token
        env:
          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
        run: |
          if [ -n "${QODANA_TOKEN:-}" ]; then
            echo "present=true" >> "$GITHUB_OUTPUT"
          else
            echo "present=false" >> "$GITHUB_OUTPUT"
          fi

      - name: 'Qodana Scan'
        if: ${{ steps.qodana-token.outputs.present == 'true' }}
        uses: JetBrains/qodana-action@v2026.1
        with:
          pr-mode: false
        env:
          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
          QODANA_ENDPOINT: 'https://qodana.cloud'

      - name: 'Skip Qodana Scan (missing cloud token)'
        if: ${{ steps.qodana-token.outputs.present != 'true' }}
        run: echo "Skipping Qodana because QODANA_TOKEN is not configured."